Western officials have identified a significant campaign of sabotage orchestrated by Russia, targeting critical infrastructure across Europe. This campaign, which has intensified since President Vladimir Putin launched the invasion of Ukraine in February 2022, has involved numerous incidents aimed at undermining support for Kyiv and sowing discord among European nations.
In November 2023, a train carrying almost 500 passengers abruptly halted in eastern Poland due to a broken overhead line, resulting in shattered windows and damage to the track. Explosives were also detonated under a passing freight train. Fortunately, no injuries were reported, and the damage was limited. Nonetheless, Poland attributed the incident to Russian intelligence services and responded decisively by deploying 10,000 troops to safeguard critical infrastructure. This incident is one of at least 145 recorded in an Associated Press database, which officials claim are part of a broader strategy of disruption by Russia.
The aim of this hybrid warfare, according to Western officials, is to drain European resources while maintaining a low-cost operation for Moscow. Each act, whether it be vandalism, cyberattacks, or arson, consumes valuable security resources and diverts attention from more pressing threats. A senior European intelligence official noted that investigations into Russian interference now occupy as much time as counter-terrorism efforts.
This campaign, described as a hybrid war, has largely resulted in minimal damage compared to the catastrophic losses experienced in Ukraine. Yet, the continuous nature of these operations ties up security services across Europe, which are compelled to cooperate extensively in investigations. According to officials, such operations often employ individuals with criminal backgrounds as proxies for Russian intelligence operatives, allowing Moscow to achieve its goals without risking the exposure of trained agents.
Dmitry Peskov, spokesperson for the Kremlin, denied any connection between Russia and the sabotage activities. Nevertheless, the data compiled by the Associated Press reveals a concerning trend: arson and explosives plots surged from one incident in 2023 to 26 in 2024, with six documented already in 2025. The countries most frequently targeted include Poland and Estonia, both of which share borders with Russia and have been staunch supporters of Ukraine. Other notable incidents have occurred in Latvia, the United Kingdom, Germany, and France.
Interestingly, officials observed a lull in the campaign during late 2024 and early 2025, likely tied to efforts to improve relations with the newly elected administration in the United States. However, the campaign has since resumed with renewed vigor, prompting one European official to note, “They are back to business.”
One key figure in the Polish railway attack is identified as Yevgeny Ivanov, a Ukrainian who allegedly collaborated with Russian military intelligence to coordinate acts of sabotage in Ukraine. Ivanov, who fled to Poland after the attack, was reportedly recruited by Yury Sizov, an officer in Russia’s GRU military intelligence. Despite his in absentia conviction in Ukraine, Ivanov managed to enter Poland due to a lack of communication between Ukrainian and Polish authorities regarding his criminal background.
The nature of these plots poses significant challenges for European security forces. The Estonian State Prosecutor, Triinu Olev-Aas, highlighted how the profile of attackers has shifted from known local criminals to foreign nationals, further complicating investigations. For instance, in January 2025, two attacks involving fires set at a supermarket and a Ukrainian restaurant were executed by individuals who had never previously been in Estonia.
The sophistication of these operations is alarming. They often involve individuals who have been recently released from prison or who have criminal ties. In one notable incident, a man, released from custody just a month prior, set fire to the Museum of the Occupation of Latvia. Such incidents demonstrate how Russia’s tactics are evolving, utilizing local criminals to conduct operations with minimal risk to its intelligence officers.
Even thwarted plots yield benefits for Moscow, as they test European defenses and drain resources. For instance, in 2024, a Ukrainian man acting on behalf of Russian military intelligence attempted to unearth explosive-laden drones buried in a cemetery in Lithuania. Although the plot was foiled, the resources expended to investigate the matter were considerable.
The sheer volume of these incidents has led to increased collaboration among European law enforcement agencies. Prosecutors in Latvia, Lithuania, and Estonia have formed joint investigation teams to address attacks linked to foreign intelligence services. In the United Kingdom, police officers are undergoing training to recognize potentially state-backed suspicious activities.
Authorities continue to warn that Russia is continually testing new methods of disruption. Recent incidents include smugglers from Belarus sending hundreds of weather balloons carrying cigarettes into Lithuania and Poland, which have forced airport closures. As Jacek Dobrzyński, spokesperson for Poland’s security minister, noted, while these balloons currently pose no immediate threat, they could easily be adapted for more harmful purposes in the future.
The ongoing sabotage campaign by Russia illustrates a complex and evolving threat to European security, necessitating continued vigilance and cooperation among nations.
